Add Docker Hub workflow and optimize Dockerfile for size by Evrard-Nil · Pull Request #1886 · nearai/ironclaw

Evrard-Nil · 2026-04-01T19:23:15Z

Summary

Switch Dockerfile from Debian bookworm-slim to Alpine for both build and runtime stages, reducing image size from 162MB to 64MB (60% reduction)
Add GitHub Actions workflow to build and push to nearaidev/ironclaw on Docker Hub
Binary size reduced from 74MB to 53MB via thin LTO, panic=abort, and codegen-units=1

Dockerfile changes

Alpine + musl: runtime base drops from ~88MB to ~11MB; no libssl needed (project uses rustls throughout)
--profile dist: thin LTO eliminates dead code across crate boundaries
panic=abort + codegen-units=1: removes unwinding tables, enables better whole-program optimization
Pinned tool versions: cargo-chef@0.1.77, wasm-tools@1.246.1 for reproducible builds

Workflow (`docker.yml`)

Triggers via workflow_call (for release.yml integration) and workflow_dispatch (on-demand)
No push trigger — avoids publishing on every staging→main promotion
Tags: version from Cargo.toml + latest + sha-<short>
Uses Docker Buildx with GitHub Actions layer cache
Requires DOCKER_REGISTRY_USER (variable) and DOCKER_REGISTRY_TOKEN (secret) — same as ironclaw-dind repo

To wire into releases, add to release.yml:

docker:
  needs: [publish]
  uses: ./.github/workflows/docker.yml

Test plan

Built image locally on macOS (Docker Desktop, linux/amd64)
Built and tested on gpu07 (Ubuntu, native amd64)
Verified ~700ms startup time
Verified health endpoint: GET /api/health → {"status":"healthy"}
Verified web UI serves (HTML, CSS, JS — all 200)
Verified authenticated endpoints: gateway status, chat threads, tools list, memory tree, settings, profile, admin users, routines, extensions
Verified SSE streaming (/api/chat/events, /api/logs/events)
Verified chat send: POST /api/chat/send → {"status":"accepted"}
Verified DB migrations apply (libSQL, 4 incremental migrations)

Metric	Before (Debian)	After (Alpine)	Change
Image size	162 MB	64 MB	-60%
Binary size	74 MB	53 MB	-28%
Compressed	~55 MB	24 MB	-56%

gemini-code-assist

Code Review

This pull request updates the project to version 0.24.0, including a detailed changelog and updated channel registry artifacts. The Dockerfile is migrated to an Alpine-based image for reduced size, and a 'dist' build profile is implemented with specific optimization flags. The MCP protocol now correctly supports camelCase deserialization for tool annotations. Review feedback recommends removing the heavy 'wasm-tools' dependency from the Docker build if it is not required and suggests moving build profile configurations from environment variables to Cargo.toml to ensure consistency and better visibility of panic behavior changes.

Copilot

Pull request overview

Introduces a Docker image publishing pipeline and Dockerfile optimizations to reduce the shipped container size, alongside a release/version bump and registry metadata updates.

Changes:

Switches the Docker build/runtime to Alpine + musl and builds with the dist profile to reduce image/binary size.
Adds a GitHub Actions workflow to build and push nearaidev/ironclaw to Docker Hub with tagging + Buildx cache.
Updates MCP tool annotation deserialization behavior and bumps release artifacts/versioning (Cargo + changelog + channel registry entries).

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`Dockerfile`	Moves builder/runtime to Alpine and uses `--profile dist` output for a smaller runtime image.
`.github/workflows/docker.yml`	New workflow to build/push Docker images with metadata-based tagging and GHA cache.
`src/tools/mcp/protocol.rs`	Ensures MCP tool annotation fields deserialize from camelCase; adds a regression test.
`registry/channels/slack.json`	Bumps Slack channel registry version and artifact URL/SHA.
`registry/channels/feishu.json`	Bumps Feishu channel registry version and artifact URL/SHA.
`registry/channels/discord.json`	Bumps Discord channel registry version and artifact URL/SHA.
`Cargo.toml`	Updates crate version to `0.24.0`.
`Cargo.lock`	Updates lockfile entry for crate version `0.24.0`.
`CHANGELOG.md`	Adds `0.24.0` release notes section.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-01T19:27:40Z

-    && rm -rf /var/lib/apt/lists/* \
+RUN apk add --no-cache musl-dev pkgconfig cmake gcc g++ make perl \
    && rustup target add wasm32-wasip2 \
    && cargo install cargo-chef wasm-tools


cargo install cargo-chef wasm-tools without pinned versions makes the Docker build non-reproducible and can break unexpectedly when upstream releases new versions. Consider pinning versions (e.g., cargo install cargo-chef --version ...) or using prebuilt binaries/images for these tools.

Suggested change

&& cargo install cargo-chef wasm-tools

&& cargo install cargo-chef --version 0.1.76 \

&& cargo install wasm-tools --version 1.221.0

Switch from Debian bookworm-slim to Alpine for both build and runtime stages, reducing image size from 162MB to 64MB (60% reduction): - Alpine + musl: runtime drops from ~88MB to ~11MB, no libssl needed (project uses rustls throughout) - Profile dist: thin LTO for smaller binary (74MB → 53MB) - panic=abort + codegen-units=1: eliminates unwinding tables and enables better whole-program optimization New docker.yml workflow builds and pushes to nearaidev/ironclaw on Docker Hub, triggered on push to main, version tags, or manual dispatch. Uses GitHub Actions cache for Docker layer caching. Tested locally (macOS) and on gpu07 (Ubuntu): gateway serves HTTP 200, SSE streams, chat API, memory/tools/settings endpoints all functional, ~700ms startup time.

- Fix image size comment (~30MB → remove specific number) - Add actions:write permission for GHA cache - Only push semver tag on version tag events (not on every main push) - Add comment explaining why panic=abort is set via env var

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-01T21:56:00Z

+          tags: |
+            # On default branch: latest
+            type=raw,value=latest,enable={{is_default_branch}}
+            # On version tags: extract semver (immutable)
+            type=match,pattern=(?:ironclaw-)?v(.*),group=1
+            # Manual override
+            type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}
+            # Short SHA for all builds
+            type=sha,prefix=


The workflow currently tags latest (default branch) and sha (all builds), but it does not add a Cargo.toml semver tag on pushes to main. This conflicts with the PR description (“latest + version on main”). If you want a version tag on main, add a tag rule that uses the extracted version output (or type=semver/type=raw based on it).

Evrard-Nil · 2026-04-01T21:58:42Z

@claude review

henrypark133 · 2026-04-02T01:23:39Z

Trigger strategy — maybe you might want to consider making this release-only instead of firing on every main push. Replace push: branches/tags with workflow_call so release.yml can invoke it, and keep workflow_dispatch for on-demand pushes. Otherwise every staging promotion to main publishes a new image.

Replace push trigger with workflow_call so release.yml can invoke it, plus workflow_dispatch for on-demand builds. This prevents every staging promotion to main from publishing a new image. Simplified tag logic — always pushes version + latest + sha.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

* Add Docker Hub workflow and optimize Dockerfile for size Switch from Debian bookworm-slim to Alpine for both build and runtime stages, reducing image size from 162MB to 64MB (60% reduction): - Alpine + musl: runtime drops from ~88MB to ~11MB, no libssl needed (project uses rustls throughout) - Profile dist: thin LTO for smaller binary (74MB → 53MB) - panic=abort + codegen-units=1: eliminates unwinding tables and enables better whole-program optimization New docker.yml workflow builds and pushes to nearaidev/ironclaw on Docker Hub, triggered on push to main, version tags, or manual dispatch. Uses GitHub Actions cache for Docker layer caching. Tested locally (macOS) and on gpu07 (Ubuntu): gateway serves HTTP 200, SSE streams, chat API, memory/tools/settings endpoints all functional, ~700ms startup time. * Address review feedback - Fix image size comment (~30MB → remove specific number) - Add actions:write permission for GHA cache - Only push semver tag on version tag events (not on every main push) - Add comment explaining why panic=abort is set via env var * Make docker workflow release-only via workflow_call Replace push trigger with workflow_call so release.yml can invoke it, plus workflow_dispatch for on-demand builds. This prevents every staging promotion to main from publishing a new image. Simplified tag logic — always pushes version + latest + sha. * Pin cargo-chef and wasm-tools versions for reproducible builds

Copilot AI review requested due to automatic review settings April 1, 2026 19:23

Copilot started reviewing on behalf of Evrard-Nil April 1, 2026 19:23 View session

gemini-code-assist Bot reviewed Apr 1, 2026

View reviewed changes

Comment thread Dockerfile Outdated

Comment thread Dockerfile

Copilot AI reviewed Apr 1, 2026

View reviewed changes

Evrard-Nil changed the base branch from staging to main April 1, 2026 20:13

Evrard-Nil changed the base branch from main to staging April 1, 2026 20:13

Evrard-Nil force-pushed the feat/docker-image-workflow branch from b3ef620 to d145144 Compare April 1, 2026 20:15

Address review feedback

044191e

- Fix image size comment (~30MB → remove specific number) - Add actions:write permission for GHA cache - Only push semver tag on version tag events (not on every main push) - Add comment explaining why panic=abort is set via env var

Copilot AI review requested due to automatic review settings April 1, 2026 21:51

Copilot started reviewing on behalf of Evrard-Nil April 1, 2026 21:52 View session

Copilot AI reviewed Apr 1, 2026

View reviewed changes

Evrard-Nil requested a review from henrypark133 April 2, 2026 01:00

Merge branch 'staging' into feat/docker-image-workflow

3dd73f3

Copilot AI review requested due to automatic review settings April 2, 2026 01:36

Copilot started reviewing on behalf of Evrard-Nil April 2, 2026 01:37 View session

Copilot AI reviewed Apr 2, 2026

View reviewed changes

Comment thread .github/workflows/docker.yml

Comment thread .github/workflows/docker.yml

Pin cargo-chef and wasm-tools versions for reproducible builds

1d5c861

henrypark133 approved these changes Apr 2, 2026

View reviewed changes

Evrard-Nil merged commit a55aff9 into staging Apr 2, 2026
14 checks passed

Evrard-Nil deleted the feat/docker-image-workflow branch April 2, 2026 02:00

ironclaw-ci Bot mentioned this pull request Apr 2, 2026

chore: promote staging to staging-promote/9c6d8cb3-23875318792 (2026-04-02 03:00 UTC) #1896

Merged

github-actions Bot mentioned this pull request Apr 9, 2026

chore: promote staging to staging-promote/42623ed1-23780941831 (2026-04-01 23:10 UTC) #1893

Merged

ironclaw-ci Bot mentioned this pull request Apr 10, 2026

chore: release #2075

Merged

ironclaw-ci Bot mentioned this pull request Apr 18, 2026

chore: release #2606

Merged

Navigation Menu

Add Docker Hub workflow and optimize Dockerfile for size - #1886

Add Docker Hub workflow and optimize Dockerfile for size#1886
Evrard-Nil merged 5 commits into
stagingfrom
feat/docker-image-workflow

Evrard-Nil commented Apr 1, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

Evrard-Nil commented Apr 1, 2026

Uh oh!

henrypark133 commented Apr 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	&& cargo install cargo-chef wasm-tools
	&& cargo install cargo-chef --version 0.1.76 \
	&& cargo install wasm-tools --version 1.221.0

Conversation

Evrard-Nil commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Dockerfile changes

Workflow (docker.yml)

Test plan

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Evrard-Nil commented Apr 1, 2026

Uh oh!

henrypark133 commented Apr 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Evrard-Nil commented Apr 1, 2026 •

edited

Loading

Workflow (`docker.yml`)